FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure Exploit (2)

Exploit for hardware platform in category web applications Exploit Title: FortiOS Leak file - Reading login/passwords in clear text. Google Dork: intext:"Please Login" inurl:"/remote/login" Exploit Author: Carlos E. Vieira Vendor Homepage: https://www.fortinet.com/ Software Link:...

FortiOS 5.6.3 - 5.6.7 FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure (Metasploit)

FortiOS 5.6.3 - 5.6.7 FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure Metasploit Exploit Title: FortiOS Leak file - Reading login/passwords in clear text. Google Dork: intext:"Please Login" inurl:"/remote/login" Date: 17/08/2019 Exploit Author: Carlos E. Vieira Vendor Homepage:...

Fortinet FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure (Metasploit)

Exploit Title: Fortinet FortiOS Leak file - Reading login/passwords in clear text. Google Dork: intext:"Please Login" inurl:"/remote/login" Date: 17/08/2019 Exploit Author: Carlos E. Vieira Vendor Homepage: https://www.fortinet.com/ Software Link:...

CVE-2019-13419

Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked...

Code injection

Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked...

CVE-2019-13419

Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked...

CVE-2019-13419

The CVE-2019-13419 issue affects floragunn Search Guard (Search Guard) prior to version 23.1, where aggregations could leak cleartext values of anonymised fields. The vulnerability is documented across multiple sources (NVD, Red Hat, CNVD) with a common description: before 23.1, an information di...

CVE-2019-1953

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when...

CVE-2019-1953

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when...

Default credentials

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when...

CVE-2019-1953 Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when...

CVE-2019-1953

CVE-2019-1953 affects Cisco Enterprise NFV Infrastructure Software (NFVIS) web portal. The issue is due to incorrect logging of the admin password when a user is forced to modify the default password on first login, allowing an authenticated attacker to view the admin cleartext password. Impact i...

Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when...

July 16, 2019—KB4507437 (Preview of Monthly Rollup)

None None...

Man-in-the-Middle (MitM)

Overview yarn is a package for dependency management. Affected versions of this package are vulnerable to Man-in-the-Middle MitM. Npm credentials such as authToken were found to be sent over clear text when processing scoped packages that are listed as resolved. This could allow a suitably...

Insecure Cookie Configuration

apache guacamole uses an insecure cookie configuration. The secure flag is not configured on session tokens, which would allow an attacker to obtain the session tokens in clear text...

libvirt security update

5.0.0-9.el7 - qemu: remove cpuhostmask and cpuguestmask from virCaps structure Wim ten Have Orabug: 29956508 5.0.0-8.el7 - api: disallow virDomainSaveImageGetXMLDesc on read-only connections Jan Tomko Orabug: 29955742 CVE-2019-10161 - domain: Define explicit flags for saved image xml Eric Blake...

Dropbox desktop application information disclosure vulnerability

Dropbox desktop application is an open source, cross-platform file online storage, synchronization, and sharing application from Dropbox, Inc. A security vulnerability exists in the Dropbox desktop application version 71.4.108.0, which originates from the Dropbox.exe file and the...

Cross site scripting

An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allows an hosted flash file on any domain to make calls to the device's webserver and pull any information that is stored on the device. In thi...

CVE-2017-8406

CVE-2017-8406 affects D-Link DCS-1130 devices. The issue is that crossdomain.xml is accessible without restrictions, allowing a hosted flash file on any domain to call the device’s webserver and retrieve stored information, including credentials in clear text. The description also notes lack of c...